At the time, I could not find the disclosure on their website.
I'm glad they disclosed shortly after discovery, but not publishing it on their site is an odd choice.